Resubmissions
13/02/2022, 03:26
220213-dy59eafben 1025/06/2021, 19:08
210625-fml1gypkn6 819/06/2021, 15:14
210619-d3391n953n 10Analysis
-
max time kernel
138s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
25/06/2021, 19:08
Static task
static1
Behavioral task
behavioral1
Sample
Tray.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Tray.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
Tray.exe
-
Size
321KB
-
MD5
6585cb51ff21007fb9ef936e96c58982
-
SHA1
7a3d5563460b9935fe84879ee14fabfc7c664825
-
SHA256
e07b0cd7eca5bc70b07ea786c3ef4da28036c901effa2193a93caf945cb2b334
-
SHA512
523c7b3ed0907a473eac04c8cb8642eeea1d3a223069f876a7e0bc18075d59f9903319f6b2e3c2fa262158f04c4ad3637568dd9b0558732c8a574ffe566efc7d
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\gm.dls Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\wfplwfs.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\NdisImPlatform.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui Tray.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\fwpkclnt.sys.mui Tray.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\InitializeFormat.tiff Tray.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Tray.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini Tray.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.15063.0_none_5fa2753162f86404\desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_10.0.15063.0_none_8f8119d2c072a618\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.15063.0_none_19586abacce7785e\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mail-app_31bf3856ad364e35_10.0.15063.0_none_026c06c18883ec63\Desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\Videos\desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.15063.0_none_0d24170c83d741b6\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Tray.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.15063.0_none_681472142b50e5ab\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Tray.exe File opened for modification C:\Windows\Media\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini Tray.exe File opened for modification C:\Windows\Web\Wallpaper\Theme1\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-programfiles_31bf3856ad364e35_10.0.15063.0_none_26af58606b13e031\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.15063.0_none_2826556bee58508f\Desktop.ini Tray.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini Tray.exe File opened for modification C:\Users\Admin\Links\desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini Tray.exe File opened for modification C:\Windows\Fonts\desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini Tray.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini Tray.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Tray.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.15063.0_none_fd2af51df2389700\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-mail-app_31bf3856ad364e35_10.0.15063.0_none_a64d6b3dd0267b2d\Desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini Tray.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini Tray.exe File opened for modification C:\Users\Public\Desktop\desktop.ini Tray.exe File opened for modification C:\Windows\Offline Web Pages\desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.15063.0_none_7458533b418bb9c3\Desktop.ini Tray.exe File opened for modification C:\Users\Public\Pictures\desktop.ini Tray.exe File opened for modification C:\Windows\Web\Wallpaper\Theme2\Desktop.ini Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_10.0.15063.0_none_6fae0d35d5f5cd29\Desktop.ini Tray.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsacl1.inf_amd64_8adcb7af71f53089\saacuni.gdl Tray.exe File opened for modification C:\Windows\SysWOW64\nb-NO\msimsg.dll.mui Tray.exe File opened for modification C:\Windows\System32\DriverStore\en-US\wdmvsc.inf_loc Tray.exe File opened for modification C:\Windows\SysWOW64\KBDSORA.DLL Tray.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\Get-DscConfigurationStatus.cdxml Tray.exe File opened for modification C:\Windows\SysWOW64\pcacli.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiaca00j.inf_amd64_2b730d5c3b5d1ba1\amd64\CL\CNCCL1D.TBL Tray.exe File opened for modification C:\Windows\SysWOW64\sqlsrv32.rll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-LanguageFeatures-OCR-en-us-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package-AutoMerged-redist~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ks.inf_amd64_58cf6ccea72a2082\ks.inf Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\remoteposdrv.inf_amd64_1c33e17d642417bb\RemotePosDrv.dll Tray.exe File opened for modification C:\Windows\SysWOW64\userenv.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnrccl1.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_0362.GPD Tray.exe File opened for modification C:\Windows\SysWOW64\wbem\portabledeviceapi.mof Tray.exe File opened for modification C:\Windows\SysWOW64\iscsicpl.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_28deabbd337eb1dc\Amd64\UNIDRV.HLP Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_07ee1bb78d96a8d3\Amd64\FXSDRV.DLL Tray.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-service-management-l1-1-0.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbrcl1.inf_amd64_205cfd311a6b4e83\BRIBMM0A.GPD Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkycl1.inf_amd64_d830c6577c8a2c44\kymona3kpsl-manifest.ini Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\wecsvc.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\MapConfiguration.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prncacla.inf_amd64_65d72b0cf837d4c1\Amd64\CNB_0370.GPD Tray.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\en-US\MSFT_GroupResource.schema.mfl Tray.exe File opened for modification C:\Windows\SysWOW64\P2P.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\modemcsa.inf_amd64_301c39e3c1162ee0\csamsp.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-SmartCard-Drivers-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\SysWOW64\msctfuimanager.dll Tray.exe File opened for modification C:\Windows\SysWOW64\chartv.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkycl1.inf_amd64_d830c6577c8a2c44\kymona3fxps.gdl Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\PrintDialogs.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\wbem\dot3.mof Tray.exe File opened for modification C:\Windows\SysWOW64\sberes.dll Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_356b66ad47b23393\netvwifimp.inf Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhpcl1.inf_amd64_c6040b9adc0369af\amd64\hpbx3w81v.gpd Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Multimedia-CastingTransmitter-Media-WOW64-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Product-onecore__Microsoft-OneCore-WSD-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-RemoteAssistance-Package-Client~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Multimedia-RestrictedCodecs-WOW64-multimedia-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-CoreSystem-MSXML6-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\wextract.exe.mui Tray.exe File opened for modification C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\prncnfg.vbs Tray.exe File opened for modification C:\Windows\SysWOW64\tr-TR\fms.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\C_10002.NLS Tray.exe File opened for modification C:\Windows\SysWOW64\NtlmShared.dll Tray.exe File opened for modification C:\Windows\SysWOW64\dmprocessxmlfiltered.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-OneCoreUAP-WCN-WOW64-Package~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\en-US\uefi.inf_loc Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_28deabbd337eb1dc\ntprint.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ts_wpdmtp.inf_amd64_69bf187a6d5605fb\ts_wpdmtp.inf Tray.exe File opened for modification C:\Windows\SysWOW64\sppwmi.dll Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\Windows.Internal.SecurityMitigationsBroker.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.Streaming.ps.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnxxcl4.cat Tray.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_468bda717012acbd\prnms005.PNF Tray.exe File opened for modification C:\Windows\SysWOW64\en-US\mskeyprotect.dll.mui Tray.exe File opened for modification C:\Windows\SysWOW64\fidocredprov.dll Tray.exe File opened for modification C:\Windows\SysWOW64\rastlsext.dll Tray.exe File opened for modification C:\Windows\SysWOW64\msjtes40.dll Tray.exe File opened for modification C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Network-Foundation-onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\shellExecute.xsd Tray.exe File opened for modification C:\Windows\SysWOW64\Windows.UI.Xaml.Resources.dll Tray.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-m..dac-rds-datacontrol_31bf3856ad364e35_10.0.15063.0_none_3812e9b6bb3b4524.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.15063.0_zh-tw_771b1f18240cc64f.manifest Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\Bin\LightedTextured_VertexLighting_VS.fxo Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_altform-unplated_contrast-black.png Tray.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Guest-Vpci-Package~31bf3856ad364e35~amd64~~10.0.15063.0.mum Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.15063.0_ru-ru_bcfeb4b91fb6ba35\comctl32.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..settings-searchdata_31bf3856ad364e35_10.0.15063.0_none_9ebf317fcfe301c7\AAA_SystemSettings_Accessibility_IsOverlappedContentEnabled.settingcontent-ms Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.15063.0_none_24ce1bef20ff9161.manifest Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookMailLargeTile.scale-400.png Tray.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_branding_1728f5d8b15e5263.cdf-ms Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_qd3x64.inf_31bf3856ad364e35_10.0.15063.0_none_d4c34c06ea6ae415.manifest Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe.config Tray.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_system32_tasks_microsoft_b7abd682baafefc2.cdf-ms Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_dual_c_hidclass.inf_31bf3856ad364e35_10.0.15063.0_none_14508d92ea1937d5.manifest Tray.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.15063.0_none_ef9aee2fe10056c2\MatchExactly.ps1 Tray.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.15063.0_ro-ro_e6a4381942e969e5\comdlg32.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-msbuild_targets_b03f5f7f11d50a3a_4.0.14917.0_none_86f6562daac6b5c5\Microsoft.NETFramework.props Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsSoundRecorder_10.1702.301.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-40.png Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingconsole_31bf3856ad364e35_10.0.15063.0_none_67210ab05bb44103\werconcpl.dll Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-qedit.resources_31bf3856ad364e35_10.0.15063.0_en-us_3806ba81821c8b35.manifest Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package-AutoMerged-analog~31bf3856ad364e35~amd64~~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_el-gr_8f9125b021f304a0_bootmgfw.efi.mui_a6e78cfa Tray.exe File opened for modification C:\Windows\WinSxS\Catalogs\0172d97625bce7c7300ded36d8a2eb8a80ba8100fce45ab63ac65389416d96b9.cat Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\x86_microsoft-windows-com-complus.res_31bf3856ad364e35_10.0.15063.0_none_e1a6188d66a32155.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-d..in-tools-mmc-schema_31bf3856ad364e35_10.0.15063.0_none_fccaa908c592edaa.manifest Tray.exe File opened for modification C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ru-ru_ea7ae6abda1aed80\comctl32.dll.mui Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Routing.dll Tray.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Holographic-Desktop-Analog-Package~31bf3856ad364e35~amd64~en-US~10.0.15063.0.cat Tray.exe File opened for modification C:\Windows\WinSxS\amd64_mchgr.inf.resources_31bf3856ad364e35_10.0.15063.0_en-us_b230b9a541bcdf9e\mchgr.inf_loc Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..dservices.resources_31bf3856ad364e35_10.0.15063.0_en-us_b2d57bd851f0bac1\dsadmin.dll.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.certifica...certenroll.interop_31bf3856ad364e35_10.0.15063.0_none_5d23571326b81b0b\Microsoft.CertificateServices.Certenroll.Interop.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-addinprocess_b03f5f7f11d50a3a_4.0.15552.17062_none_3811d1a1ac4ff173\AddInProcess.exe.config Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..settings-searchdata_31bf3856ad364e35_10.0.15063.0_none_9ebf317fcfe301c7\AAA_SystemSettings_Display_Resolution.settingcontent-ms Tray.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_hu-hu_79df2140f9147efa_bootmgfw.efi.mui_a6e78cfa Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\x86_microsoft-windows-imapiv2-base.resources_31bf3856ad364e35_10.0.15063.0_en-us_8e10ed118a270145.manifest Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\SmallTile.scale-125.png Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.15063.0_none_689a308dc3e71916\fvewiz.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-wmssharinghost_31bf3856ad364e35_10.0.15063.0_none_1392f1532a10589c\WmsSharingHost.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_wdmvsc.inf.resources_31bf3856ad364e35_10.0.15063.0_en-us_2d387f3fa5170ce1\dmvsc.sys.mui Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_windows-media-ocr_31bf3856ad364e35_10.0.15063.0_none_16a86d6fe3273216.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_mdmomrn3.inf_31bf3856ad364e35_10.0.15063.0_none_59338f151a4eca76.manifest Tray.exe File opened for modification C:\Windows\MiracastView\MiracastView.dll Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ru-ru_6fbaaffc5d91072d\comctl32.dll.mui Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.ZuneMusic_10.16112.11621.0_x64__8wekyb3d8bbwe\Assets\MusicStoreLogo.scale-100.png Tray.exe File opened for modification C:\Windows\WinSxS\amd64_dual_xboxgip.inf_31bf3856ad364e35_10.0.15063.0_none_7d0f604ac0d845b7\devauthe.sys Tray.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-system.runtime.handles_b03f5f7f11d50a3a_4.0.14917.0_none_612090b76043617e\System.Runtime.Handles.dll Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_en-us_507ecdc8096d0ff0.manifest Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..xecutable.resources_31bf3856ad364e35_10.0.15063.0_en-us_09b4ba6838ca9d5e\msiexec.exe.mui Tray.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-system_enterpriseservices_tlb_b03f5f7f11d50a3a_4.0.14917.0_none_3c893e3fbfa94ad4\System.EnterpriseServices.tlb Tray.exe File opened for modification C:\Windows\WinSxS\amd64_prnhpcl1.inf_31bf3856ad364e35_10.0.15063.0_none_07f5bbceb0a06ae1\amd64\hprasterZJS-manifest.ini Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\x86_microsoft-windows-dot3gpui.resources_31bf3856ad364e35_10.0.15063.0_en-us_d0e33557c1263c78.manifest Tray.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\peverify.dll Tray.exe File opened for modification C:\Windows\WinSxS\FileMaps\$$_provisioning_packages_e07c8f8a91f541c4.cdf-ms Tray.exe File opened for modification C:\Windows\ImmersiveControlPanel\Settings\Classic_{E4B554C8-B067-4540-A478-0565BB1F76B9}.settingcontent-ms Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Content\surfaceHub\en-GB\doc_offline_getconnected.xml Tray.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-75574BF9.pf Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_networking-mpssvc-powershell-core_31bf3856ad364e35_10.0.15063.0_none_c6a3b06c8628670f.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.15063.0_none_f387fb9c810fa2b6.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\wow64_microsoft-windows-i..l-keyboard-00000425_31bf3856ad364e35_10.0.15063.0_none_047096fed0437a4b.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\msil_system.management.automation_31bf3856ad364e35_10.0.15063.0_none_d65a443660c3006b.manifest Tray.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_prnms010.inf_31bf3856ad364e35_10.0.15063.0_none_8fb2f02cdf43ea18.manifest Tray.exe File opened for modification C:\Windows\InfusedApps\Packages\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\mc_16x11.png Tray.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.15063.0_none_e08e1b062a8d984d\DmOmaCpMo.exe Tray.exe